CVE-2026-42006 Details
Description
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.
A vulnerability allowing uncontrolled memory usage has been identified in Open-Xchange Dovecot Pro and Community Edition, specifically in versions 3.0.5, 3.1.4, and 2.4.3. The issue arises from an incomplete fix for a previous vulnerability, which only addressed closing braces but left open braces unregulated. This oversight allows attackers to manipulate memory usage by exceeding the configured limits. Although no public exploits are known, the vulnerability can be exploited by sending excessive bracing through IMAP, causing memory consumption up to the application's memory limit.
Users can upgrade to OX Dovecot Pro 3.1.5 or OX Dovecot CE 2.4.4, or configure the vsz_limit for the IMAP process to a low value.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| dovecot dovecot | < 2.4.4 |
CPE
Remediation
| |
| open-xchange dovecot | < 3.1.5 |
CPE
Remediation
| |
Change History
14 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | redhat-SADP |
| Jul 28, 2026 | CVE Modified | redhat-SADP |
| Jul 27, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Modified | redhat-SADP |
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | New CVE Received | [email protected] |